From a6fcc74e1ae5e09e128daff00205d0f2bbe0a3b8 Mon Sep 17 00:00:00 2001
From: Trevor Royer <troyer@redhat.com>
Date: Wed, 18 Jan 2023 15:59:46 -0600
Subject: [PATCH 1/3] add sc settings to oauth proxy pod

---
 charts/mlflow-server/templates/deployment.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/charts/mlflow-server/templates/deployment.yaml b/charts/mlflow-server/templates/deployment.yaml
index b11bcbe..2c9f157 100644
--- a/charts/mlflow-server/templates/deployment.yaml
+++ b/charts/mlflow-server/templates/deployment.yaml
@@ -121,7 +121,9 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
         {{- if .Values.openshiftOauth.enabled }}
         - name: oauth-proxy
-          image: registry.redhat.io/openshift4/ose-oauth-proxy:v4.10
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: registry.redhat.io/openshift4/ose-oauth-proxy:v4.11
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8443

From d6d49da0f618bc6f8da7c2998d1280ad42e9edc1 Mon Sep 17 00:00:00 2001
From: Trevor Royer <troyer@redhat.com>
Date: Wed, 18 Jan 2023 15:59:59 -0600
Subject: [PATCH 2/3] setup default sc settings

---
 charts/mlflow-server/values.yaml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/charts/mlflow-server/values.yaml b/charts/mlflow-server/values.yaml
index b376660..d0d7828 100644
--- a/charts/mlflow-server/values.yaml
+++ b/charts/mlflow-server/values.yaml
@@ -41,15 +41,15 @@ podAnnotations: {}
 
 # -- 
 podSecurityContext: {}
-  # fsGroup: 2000
-
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+  # seccompProfile:
+  #   type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  capabilities:
+    drop:
+      - ALL
 
 objectStorage:
   objectBucketClaim:

From 64080b6a4681a6ce401fb6d56237788b83758d8a Mon Sep 17 00:00:00 2001
From: Trevor Royer <troyer@redhat.com>
Date: Wed, 18 Jan 2023 16:00:07 -0600
Subject: [PATCH 3/3] add default sc to tests

---
 charts/mlflow-server/templates/tests/test-connection.yaml | 6 ++++++
 charts/mlflow-server/templates/tests/test-training.yaml   | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/charts/mlflow-server/templates/tests/test-connection.yaml b/charts/mlflow-server/templates/tests/test-connection.yaml
index 6368989..e64f886 100644
--- a/charts/mlflow-server/templates/tests/test-connection.yaml
+++ b/charts/mlflow-server/templates/tests/test-connection.yaml
@@ -9,6 +9,12 @@ metadata:
 spec:
   containers:
     - name: wget
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        capabilities:
+          drop:
+            - ALL
       image: busybox
       command: ['wget']
       args: ['{{ include "mlflow-server.fullname" . }}:{{ .Values.service.port }}']
diff --git a/charts/mlflow-server/templates/tests/test-training.yaml b/charts/mlflow-server/templates/tests/test-training.yaml
index 65b6e92..fc151ab 100644
--- a/charts/mlflow-server/templates/tests/test-training.yaml
+++ b/charts/mlflow-server/templates/tests/test-training.yaml
@@ -9,6 +9,12 @@ metadata:
 spec:
   containers:
     - name: training
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        capabilities:
+          drop:
+            - ALL
       image: "{{ .Values.trainingTestImage.repository }}:{{ .Values.trainingTestImage.tag | default .Chart.AppVersion }}"
       imagePullPolicy: "{{ .Values.trainingTestImage.pullPolicy}}"
       env: